CVE-2026-0322

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

State: Published
Severity: 8.6 High
Published: Oct 14, 2026
Updated: Oct 15, 2026
Reserved: Nov 3, 2025

Description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red	palo_alto
4.0	8.5 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red	palo_alto

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
Cloud NGFWPalo Alto Networks	AllNot affected
PAN-OSPalo Alto Networks	12.2.0 to before 12.2.4Affectedfrom 12.2.4Not affected 12.1.0 to before 12.1.10-h2Affectedfrom 12.1.4-h12Not affectedfrom 12.1.7-h8Not affectedfrom 12.1.10-h2Not affected 11.2.0 to before 11.2.16Affectedfrom 11.2.4-h22Not affectedfrom 11.2.7-h21Not affectedfrom 11.2.10-h15Not affectedfrom 11.2.13-h3Not affectedfrom 11.2.16Not affected 11.1.0 to before 11.1.16-h3Affectedfrom 11.1.4-h37Not affectedfrom 11.1.6-h39Not affectedfrom 11.1.7-h11Not affectedfrom 11.1.10-h35Not affectedfrom 11.1.13-h15Not affectedfrom 11.1.16-h3Not affected 10.2.0 to before 10.2.18-h12Affectedfrom 10.2.7-h38Not affectedfrom 10.2.10-h41Not affectedfrom 10.2.13-h26Not affectedfrom 10.2.16-h11Not affectedfrom 10.2.18-h12Not affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2026-0322vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.